stapstd elf note flags

[Frank Ch. Eigler]

Hi -

> Ok, I see what you are asking. For nop1, there is indeed one int3,
> then kernel analyzes the instruction interrupted and sees that it's
> one of the instructions that can be emulated without going back to
> user space for single stepping. E.g., stack pushes are simulated like
> that, for instance; and a bunch of other instructions as well. And for
> such emulated instructions, we don't need single-stepping, so we avoid
> another context switch and interrupt.

Oh, right.  I've been out of kprobes/uprobes land too long to recall
this part.


> [...]
> But in this case, if we knew the size (1+5=6) we could safely assume
> that nop5 was emitted through USDT macros. But oh well, we have to
> find another way.

OK just spitballing here, but what if we emitted two adjacent notes,
one for the nop1 and one for the nop5.  But mess with the
name/provider strings of the second one a bit, so an old-school
systemtap or stapbpf or whatever program would fail to match the
second one.  Newer tools could identify the adjacency and relationship
of the pair, and merge their semantics (place the probe on top of the
nop5 only).

- FChE